JP5508903B2 - Information processing apparatus, semiconductor integrated circuit device, and abnormality detection method - Google Patents

Description

  The present invention relates to an information processing apparatus and a semiconductor integrated circuit device, and more particularly to an abnormality detection method for detecting an operation abnormality of the information processing apparatus and the semiconductor integrated circuit.

  In recent years, with increasing awareness of global environmental issues, regulations on power consumption and standby power have been required. In addition, electronic devices around us, such as home-use disaster prevention / security devices and portable devices, are expanding. In such electronic devices, competition for development in terms of extending the life and size of batteries has become intense, and energy saving at the system level has become an important issue.

  In a microcontroller that controls the standby state of a system or a microcontroller for a battery-powered small system, a standby mode in which only some peripheral functions operate from the viewpoint of low power consumption, and both the peripheral functions and the CPU operate. An intermittent operation in which the normal operation mode is alternately repeated can be considered. In applications intended to periodically capture signals output from external devices and sensors, it is common to reduce power consumption by activating the normal operation mode in an event-driven manner.

  On the other hand, in a digital circuit of a semiconductor integrated circuit, an asynchronous design technology that reduces current consumption due to clock synchronous operation by using a handshake signal of a circuit before and after the flip-flop as a clock input instead of a clock signal input to the flip-flop. There is. Even in an event-driven microcontroller, it is conceivable to use an asynchronous design technique that does not use a clock in order to reduce power consumption.

  In a general microcontroller, abnormal detection of CPU operation is often performed by a method using a timer counter called a watchdog timer. In the method using the watchdog timer, the counter counts the clock, and the CPU clears the counter so as not to overflow due to an instruction at regular intervals. If the CPU is operating normally, the counter will not overflow. When an overflow is detected, it is determined that an abnormality has occurred due to a CPU runaway or the like. In other words, the abnormality detection method using the watchdog timer cannot be asynchronous because a clock is required for abnormality detection. Therefore, it is expected to realize an abnormality detection circuit that can be realized even with an asynchronous circuit.

  In addition, when the CPU is realized by an asynchronous design technology, for example, when noise is unintentionally triggered by a power supply noise in a standby state, the handshake circuit malfunctions and the program counter and various flags The register value may be updated to an incorrect value. Such a possibility is considered to be higher than a malfunction at the time of clock stop in a synchronous CPU, and a countermeasure for realizing a safer system is desired.

  Japanese Patent Application Laid-Open No. 2000-20352 describes a technique for detecting an abnormality by monitoring a stack pointer used when a microcontroller performs an interrupt process. The stack pointer designates a storage destination address of a stack for storing return destination address information and the like. An error is detected when data is excessively saved in the stack or when data is excessively restored from the stack.

  Such a technique can be applied as an abnormality detection circuit for a microcontroller that operates in an event-driven manner to which an asynchronous design technique is applied. However, it is impossible to detect an abnormality caused by a CPU runaway that does not affect the stack pointer or an abnormality that causes the microcontroller to fall into a deadlock state. That is, when the program routine that does not operate the stack pointer falls into an infinite loop, or when the CPU does not operate in a deadlock state, the stack is not saved or restored. Therefore, stack overflow and stack underflow do not occur and an abnormality cannot be detected.

JP 2000-20352 A

  The present invention provides an information processing apparatus, a semiconductor integrated circuit device, and an abnormality detection method capable of detecting an abnormal operation of a CPU.

  Hereinafter, means for solving the problem will be described using the numbers and symbols used in the “DETAILED DESCRIPTION”. These numbers and symbols are added to clarify the correspondence between the description of [Claims] and [Mode for Carrying Out the Invention]. However, these numbers and symbols should not be used for the interpretation of the technical scope of the invention described in [Claims].

  In an aspect of the present invention, the semiconductor integrated circuit device includes a CPU (100), an interrupt counter (410), and a counter abnormal value detection circuit (430). The interrupt counter (410) increments the count value based on an interrupt start signal (IRS) indicating that an interrupt output in response to an interrupt signal (INT) indicating an interrupt request to the CPU (100) is received. Then, the count value is decremented based on an interrupt end signal (IRE) indicating that the processing corresponding to the interrupt has ended. The counter abnormal value detection circuit (430) compares the count value (IRC) with a predetermined value to detect an abnormality.

  In another aspect of the present invention, an abnormality detection method is an abnormality detection method for detecting an abnormal operation of a CPU, and an interrupt output in response to an interrupt signal (INT) indicating an interrupt request to the CPU (100). A step of incrementing the count value based on an interrupt start signal (IRS) indicating that the processing has been received, and a step of decrementing the count value based on an interrupt end signal (IRE) indicating that the processing corresponding to the interrupt has ended. And detecting the abnormality of the counter value by comparing the count value (IRC) with a predetermined value.

  According to the present invention, it is possible to provide an information processing apparatus, a semiconductor integrated circuit device, and an abnormality detection method that can detect an abnormal state in which the CPU does not operate the stack.

It is a figure which shows the structure of the information processing apparatus which concerns on the 1st Embodiment of this invention. 3 is a timing chart for explaining the operation of the information processing apparatus according to the first embodiment. It is a timing chart explaining other operation | movement of the information processing apparatus which concerns on 1st Embodiment. It is a timing chart explaining other operation | movement of the information processing apparatus which concerns on 1st Embodiment. It is a figure which shows the structure of the information processing apparatus which concerns on the 2nd Embodiment of this invention. 6 is a timing chart for explaining the operation of the information processing apparatus according to the second embodiment.

  DESCRIPTION OF EMBODIMENTS Embodiments for carrying out the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram illustrating the configuration of the information processing apparatus according to the first embodiment. The information processing apparatus is a semiconductor integrated circuit device including a CPU 100, an interrupt controller 200, abnormality detection circuits 300 and 400, an OR circuit 360, and peripheral circuits 251 and 252. The interrupt controller 200 receives an internal interrupt signal INT1 output from the peripheral circuit 251, an internal interrupt signal INT2 output from the peripheral circuit 252, and an external interrupt signal INT0 input from the outside of the information processing apparatus. The interrupt controller 200 includes interrupt flag registers 210, 220, and 230. The interrupt flag registers 210, 220, and 230 receive the external interrupt signal INT0, the internal interrupt signal INT1, and the internal interrupt signal INT2, respectively. When the interrupt flag registers 210, 220, and 230 are set, the interrupt controller 200 sets a vector address VA corresponding to the interrupt flag registers 210, 220, and 230, and outputs an interrupt start signal IRS to the CPU 100 to generate an interrupt. To be notified. In addition, signals IF0, IF1, and IF2 indicating outputs of the interrupt flag registers 210, 220, and 230 are output to the abnormality detection circuit 300.

  The CPU 100 performs an interrupt process with the interrupt start signal IRS and the vector address VA, which are outputs from the interrupt controller 200, as inputs, and outputs an interrupt end signal IRE to the interrupt controller 200 and the abnormality detection circuit 400 when the interrupt process ends.

  The abnormality detection circuit 400 includes an interrupt counter 410, an interrupt acceptance number upper limit setting register 420, and a counter abnormality value detection circuit 430. The interrupt counter 410 receives the interrupt start signal IRS and increments the interrupt count value IRC, and receives the interrupt end signal IRE and decrements the interrupt count value IRC. The interrupt counter 410 outputs the interrupt counter value IRC to the counter abnormal value detection circuit 430. The interrupt acceptance upper limit setting register 420 holds the number of interrupts that can be accepted and outputs it to the counter abnormal value detection circuit 430. The number of interrupts that can be accepted is preferably set by the CPU 100. The counter abnormal value detection circuit 430 receives the interrupt counter value IRC and the output IRM of the interrupt acceptance number upper limit setting register 420 and outputs a counter abnormal value detection signal EC when the interrupt count value exceeds the acceptable number of interrupts. .

  The abnormality detection circuit 300 includes an interrupt flag hold number detection circuit 310, a hold number upper limit setting register 320, and a hold number abnormality detection circuit 330. The interrupt flag hold count detection circuit 310 receives the outputs IF0, IF1, and IF2 of the interrupt flag registers 210, 220, and 230 and outputs the interrupt flag hold count IFC. The hold number upper limit setting register 320 holds the number of interrupts that can be held and outputs the interrupt number to the hold number abnormality detection circuit 330. The number of interrupts that can be held is preferably set by the CPU. The hold number abnormality detection circuit 330 receives the interrupt flag hold number IFC and the output IFM of the hold number upper limit setting register 320, and outputs a hold number abnormality detection signal EF when the interrupt hold number becomes an interruptable number error.

  The OR circuit 360 receives the counter abnormal value detection signal EC and the pending number abnormality detection signal EF, and outputs an abnormality detection signal ER.

  The interrupt flag registers 210, 220, and 230 of the interrupt controller 200 are set by the rising edge of the external interrupt signal INT0, the internal interrupt signal INT1, and the internal interrupt signal INT2, respectively, and are cleared by the rising edge of the interrupt start signal IRS. When the interrupt flag registers 210, 220, and 230 are set, the interrupt controller 200 outputs an interrupt start signal IRS and a vector address VA to the CPU 100. For example, when the interrupt flag register 220 is set when all the interrupt flag registers 210, 220, and 230 are cleared, the interrupt start signal IRS becomes active, and the vector address VA corresponds to the interrupt flag register 220. Interrupt processing address is set. The interrupt controller 200 manages interrupt priority. Therefore, the output timing of the interrupt start signal IRS and the vector address VA changes according to the interrupt priority. Assuming that the priority is the interrupt flag registers 210, 220, and 230 in descending order, the interrupt start signal IRS and the vector address do not change even if the interrupt flag register 230 is set when the interrupt flag register 220 is set. When the interrupt flag register 210 is set, an interrupt start signal IRS is generated, and an interrupt processing address corresponding to the interrupt flag register 210 is set to the vector address VA.

  When the interrupt start signal IRS becomes active, the CPU 100 starts an interrupt process indicated by the vector address VA. When the interrupt process ends, the CPU 100 activates the interrupt process end signal IRE.

  When the interrupt end signal IRE becomes active, the interrupt controller 200 detects that the interrupt process executed by the CPU 100 has ended. If there is a pending interrupt, the interrupt controller 200 controls the output of the interrupt start signal IRS and the vector address VA according to the priority.

  The interrupt counter 410 of the abnormality detection circuit 400 increments the count value by the interrupt start signal IRS and decrements by the interrupt end signal IRE. Therefore, the count value of the interrupt counter 410 represents the number of multiple interrupts during normal operation. The value is output as the interrupt counter value IRC. The interrupt acceptance number upper limit setting register 420 is a register that is set when the CPU 100 executes a program, and the set value indicates the upper limit number of multiple interrupts. Here, it is assumed that “3” is set in the interrupt acceptance number upper limit setting register 420. The counter abnormal value detection circuit 430 detects whether there is an abnormality in the interrupt counter value IRC. Specifically, the counter abnormal value detection signal EC is output when the interrupt counter value IRC underflows and when the value reaches the value IRM set in the interrupt acceptance number upper limit setting register 420.

  The interrupt flag hold count detection circuit 310 of the abnormality detection circuit 300 outputs the number of set interrupt flag registers 210, 220, and 230 as the interrupt flag hold count IFC. This indicates the number of interrupts that have not been processed by the CPU 100. The pending number upper limit setting register 320 is a register that is set when the CPU 100 executes a program, and the set value indicates the upper limit of the pending number of interrupts that have not started processing. Here, it is assumed that “3” is set in the holding number upper limit setting register 320. The hold number abnormality detection circuit 330 compares the interrupt flag hold number IFC with the output IFM of the hold number upper limit setting register 320, and outputs a hold number abnormality detection signal EF when the match or the interrupt flag hold number IFC exceeds.

  The counter abnormal value detection signal EC and the pending number abnormality detection signal EF are connected to the OR circuit 360, and an abnormality occurs when at least one of the counter abnormal value detection signal EC and the pending number abnormality detection signal EF is active. As a result, the abnormality detection signal ER is activated.

  Next, the operation until abnormality detection will be described.

  FIG. 2 is a timing chart showing an example in which the interrupt counter 410 has underflowed. This is an example in which the abnormality detection circuit 400 counts the number of start and end of multiple interrupts and outputs an abnormality detection signal ER when the count number underflows. This is an operation for detecting an abnormality such as when an interrupt process is performed unintentionally due to an abnormality in the CPU 100.

  At time T1, the internal interrupt signal INT1 becomes active (FIG. 2 (c)), and the interrupt flag register 220 is set (FIG. 2 (d)). When the interrupt flag register 220 is set, the interrupt start signal IRS and the vector address VA indicating the interrupt processing corresponding to the interrupt flag register 220 are activated (FIGS. 2G and 2H). Further, the interrupt counter 410 is incremented, and the output IRC indicates “1” (FIG. 2 (j)). At the same time as the interrupt start signal IRS becomes active, the interrupt flag register 220 is cleared (FIG. 2 (d)).

  At time T2, the internal interrupt signal INT2 becomes active (FIG. 2 (e)), and the interrupt flag register 230 is set (FIG. 2 (f)). However, the interrupt end signal IRE is not active after time T1 (FIG. 2 (i)). That is, since the interrupt process is being performed by the interrupt flag register 220, the interrupt start signal IRS is not activated even when the interrupt flag register 230 having a lower priority than the interrupt flag register 220 is set (FIG. 2 (g)). The vector address VA does not change (FIG. 2 (h)).

  At time T3, the CPU 100 notifies the interrupt controller 200 and the abnormality detection circuit 400 that the interrupt processing for the internal interrupt signal INT1 has ended by an interrupt end signal IRE (FIG. 2 (i)). As a result, the interrupt counter 410 is decremented and the output IRC becomes “0” (FIG. 2 (j)). Since the interrupt processing for the internal interrupt signal INT1 is completed, the interrupt controller 200 activates the interrupt start signal IRS at time T4 (FIG. 2 (g)), and the vector address indicating the interrupt processing corresponding to the interrupt flag register 230 VA is set (FIG. 2 (h)). Further, the interrupt counter 410 is incremented (FIG. 2 (j)), the interrupt flag register 230 is cleared, and the output IF2 becomes inactive (FIG. 2 (f)).

  At time T5, the CPU 100 activates the interrupt end signal IRE to notify that the interrupt processing for the interrupt signal INT2 has ended (FIG. 2 (i)). The interrupt counter 410 decrements the count value, and the output IRC indicates “0” (FIG. 2 (j)). All interrupts are completed.

  Here, it is assumed that an unintended interrupt process occurs in the CPU 100 after time T5. When the interrupt end signal IRE becomes active at time T6 even though the interrupt start signal IRS is not input (FIG. 2 (i)), the interrupt counter 410 is decremented and underflows (FIG. 2 ( j)). The counter abnormal value detection circuit 430 detects an abnormality and outputs a counter abnormal value detection signal EC, and the abnormality detection signal ER becomes active (FIG. 2 (k)).

  FIG. 3 is a timing chart showing an example in which the interrupt counter 410 detects an abnormality exceeding a predetermined number. The abnormality detection circuit 400 counts the number of start and end of multiple interrupts, and outputs an abnormality detection signal ER when the count exceeds a certain value. This is an operation for detecting an abnormality when an unintended interrupt start signal IRS is generated due to an abnormality in the interrupt controller 200 or the CPU 100, or when a predetermined number is exceeded without being able to process multiple interrupts. FIG. 3 shows the same operation until time T5 as compared with FIG. 2, and thus the description until time T5 is omitted.

  At time T7, the internal interrupt signal INT2 becomes active (FIG. 3 (e)), and the interrupt flag register 230 is set (FIG. 3 (f)). As a result, the interrupt start signal IRS becomes active (FIG. 3 (g)), and the vector address VA indicating the interrupt processing corresponding to the interrupt flag register 230 is set (FIG. 3 (h): to indicate the same address here) There is no change in value). Further, the interrupt counter 410 is incremented by the interrupt start signal IRS and changes to “1” (FIG. 3 (j)). After that, it is assumed that the interruption process is not completed due to the abnormality of the CPU.

  At time T8, the internal interrupt signal INT1 becomes active (FIG. 3C), and the interrupt flag register 220 is set (FIG. 3D). The interrupt flag register 220 has a higher priority than the interrupt flag register 230. Therefore, the interrupt start signal IRS becomes active (FIG. 3 (g)), and the vector address VA indicating the interrupt process corresponding to the interrupt flag register 230 is set (FIG. 3 (h)). Further, the interrupt counter 410 is incremented, and the output IRC changes to “2” ((j) in FIG. 3).

  At time T9, the external interrupt signal INT0 becomes active and the interrupt flag register 210 is set (FIG. 3 (a)). Since the interrupt flag register 210 has a higher priority than the interrupt flag register 220, the interrupt start signal IRS becomes active (FIG. 3G), and the vector address VA indicating the interrupt processing corresponding to the interrupt flag register 210 is set. (FIG. 3 (h)). Further, the interrupt counter 410 is incremented to “3” (FIG. 3 (j)). As a result, it coincides with the value “3” set in the interrupt acceptance number upper limit setting register 420, the counter abnormal value detection circuit 430 detects the abnormality, outputs the counter abnormal value detection signal EC, and outputs the abnormality detection signal ER. Becomes active (FIG. 3 (k)).

  FIG. 4 is a timing chart showing an example of detecting an abnormality in which the interrupt flag hold number exceeds a predetermined value. The abnormality detection circuit 300 calculates the number of pending interrupts for which processing has not started, and outputs an abnormality detection signal ER when the number of suspensions exceeds a certain value. This is an operation for detecting an abnormality when the interruption cannot be processed due to an abnormality in the interrupt controller 200 or the CPU 100.

  FIG. 4 shows the interrupt flag hold number IFC instead of the value IRC of the interrupt counter 410, as compared with FIG. The interrupt flag pending number IFC represents the number of registers set in the interrupt flag registers 210, 220, and 230. Further, the value of the holding number upper limit setting register 320 is fixed to “3”. Since the operation up to time T5 is the same as in FIGS. 2 and 3, the description thereof is omitted.

  At time T10, the external interrupt signal INT0 becomes active (FIG. 4 (a)), and the interrupt flag register 210 is set (FIG. 4 (b)). The interrupt flag hold count detection circuit 310 sets the hold count to “1” and sets it in the output IFC (FIG. 4 (j)). As a result, the interrupt start signal IRS becomes active (FIG. 4G), and the vector address VA indicating the interrupt processing corresponding to the interrupt flag register 210 is set (FIG. 4H). When the interrupt start signal IRS becomes active, the interrupt flag register 210 is cleared (FIG. 4B), and the interrupt flag hold count detection circuit 310 sets the hold count to “0” and sets it to the output IFC (FIG. 4 (j )). After that, it is assumed that the interruption process is not completed due to the abnormality of the CPU 100.

  At time T11, the internal interrupt signal INT1 becomes active (FIG. 4C), and the interrupt flag register 220 is set (FIG. 4D). However, since the interrupt process corresponding to the interrupt flag register 210 having the highest priority is being executed, the interrupt start signal IRS is not activated (FIG. 4 (g)). Therefore, the interrupt flag register 220 is not cleared (FIG. 4D), and the interrupt flag hold count detection circuit 310 keeps the hold count set to “1” in the output IFC (FIG. 4J).

  At time T12, the external interrupt signal INT0 becomes active (FIG. 4A), and the interrupt flag hold count detection circuit 310 sets the hold count to “2” and sets it to the output IFC (FIG. 4J). At time T13, the internal interrupt signal INT2 becomes active (FIG. 4 (e)). For the same reason, the interrupt flag registers 210 and 230 are not cleared after being set (FIGS. 4B and 4F). At time T13, the interrupt flag hold count detection circuit 310 sets the hold count to “3” and outputs IFC. (FIG. 4 (j)). Since the hold number abnormality detection circuit 330 matches the set value “3” of the hold number upper limit setting register 320, the hold number abnormality detection signal EF is activated and the abnormality detection signal ER is activated (FIG. 4 (k)). .

  Normally, in a microcontroller that permits multiple interrupts, when an interrupt is accepted, the program counter value at that time is saved in the stack before interrupt processing is started. When returning from the interrupt processing, the program counter value stored in the stack is restored to the program counter. In a routine not related to saving / restoring of the stack pointer, if the CPU goes into an infinite loop due to runaway, the value of the stack pointer does not change, so even if the stack pointer is monitored, runaway cannot be detected. As shown in the present embodiment, the abnormality detection circuit 400 includes an interrupt counter 410, an interrupt acceptance number upper limit setting register 420, and an interrupt counter 410. The interrupt counter 410 is incremented by a subsequent interrupt request and exceeds the set value of the upper limit value set in the accepted number upper limit setting register 420, so even if the routine goes into an infinite loop in a routine not related to saving / restoring of the stack pointer, CPU runaway can be detected. In addition, in the CPU runaway in which some routine is executed even when no interrupt request is generated, the interrupt counter 410 may underflow and detect the CPU runaway even when an interrupt end signal without a stack recovery is generated. it can.

  In an embedded system using a microcontroller, the peripheral circuit normally requests an interrupt continuously. The above-described abnormality detection circuit 300 includes an interrupt flag hold number detection circuit 310 that detects the total number of hold of the interrupt flag registers 210, 220, and 230. Therefore, it can be determined that the operation of the CPU 100 has stopped when the number of pending interrupts is equal to or greater than the reference value.

  In addition, if the CPU runaway due to an infinite loop does not output an interrupt end signal, an abnormality in the microcontroller that does not allow multiple interrupts or an abnormality during interrupt processing with the highest priority is not incremented because the interrupt counter 410 is not incremented. Can be detected.

  FIG. 5 is a diagram showing a configuration of an information processing apparatus according to the second embodiment of the present invention. The CPU 100 of the information processing apparatus according to the second embodiment is an asynchronously designed CPU, and internally includes a timing control circuit 140, a program counter 110 controlled by the timing control circuit 140, a stack pointer 120, a flag register 130, Is provided. The information processing apparatus according to the second embodiment further includes an abnormality detection circuit 500 as compared with the information processing apparatus according to the first embodiment.

  The timing control circuit 140 is a circuit that generates a control pulse and operates each register. Asynchronous CPUs are not designed to send pulses such as clock signals to all registers at the same time as synchronous CPUs, but are designed to send pulses only to necessary registers. The timing control circuit 140 is an asynchronous handshake control circuit that generates such a pulse. The timing control circuit 140 outputs timing control signals TC1, TC2, and TC3 to the program counter 110, the stack pointer 120, and the flag register 130, respectively.

  The abnormality detection circuit 500 includes an OR circuit 510, a zero detection circuit 520, and an AND circuit 530. The OR circuit 510 generates a logical sum of the timing control signals TC1, TC2, and TC3 and outputs an output signal TOR. The zero detection circuit 520 receives the interrupt counter value IRC from the abnormality detection circuit 400 and outputs a signal ZR indicating that the interrupt counter value IRC is “0”. The logical product circuit 530 receives the output signal TOR of the logical sum circuit 510 and the output signal ZR of the zero detection circuit 520, and outputs the logical product as the output signal EZ. Therefore, the fact that the output signal EZ of the AND circuit 530 is active indicates that the CPU 100 is operating in a state where no interrupt is accepted. The output signal EZ of the abnormality detection circuit 500, the output signal EC of the abnormality detection circuit 400, and the output signal EF of the abnormality detection circuit 300 are input to the OR circuit 370, and an abnormality detection signal ER that is a logical sum is output. Since other configurations are the same as those of the first embodiment, description thereof is omitted.

  Next, the operation of the abnormality detection circuit 500 will be described with reference to the timing chart shown in FIG.

  Before time T21, the value IRC of the interrupt counter 410 is “0”. This indicates a state in which no processing is performed in the asynchronous CPU 100 that operates in an event-driven manner by an interrupt, and the CPU 100 is in a standby state waiting for an event. While in the standby state, the timing control signals TC1, TC2, and TC3 in the CPU 100 are not active.

  At time T21, an interrupt signal is input and the interrupt start signal IRS becomes active (FIG. 6 (e)). The interrupt counter 410 increments the count value, and the interrupt count value IRC changes to “1” ((g) in FIG. 6). The CPU 100 starts interrupt processing.

  In the period T22 from time T21 to time T23, the CPU 100 operates, so the timing control circuit 140 generates timing control signals TC1, TC2, and TC3 and supplies them to the program counter 110, the stack pointer 120, and the register flag 130 (FIG. 6 (a) (b) (c)).

  At time T23, the interrupt process ends and the interrupt end signal IRE becomes active (FIG. 6 (f)). In response to the interrupt end signal IRE, the interrupt counter 410 decrements the count value, and the interrupt count value IRC changes to “0” (FIG. 6 (g)). From here, the CPU 100 again enters a standby state.

  However, when a pulse is generated in the timing control signal TC1 at time T24 due to an abnormal operation due to power supply noise or the like (FIG. 6A), the output signal TOR of the OR circuit 510 becomes active (FIG. 6D). . Since the interrupt counter value IRC is “0”, the output signal ZR of the zero detection circuit 520 is active (FIG. 6 (h)), and the output signal EZ of the logical AND circuit 530 is also active (FIG. 6 (i)). ). Therefore, the abnormality detection signal ER becomes active (FIG. 6 (j)), and an abnormality is detected.

  As described above, when the CPU is asynchronous, an abnormality detection circuit for further improving reliability can be provided, and an abnormal operation in the CPU can be detected in the standby state of the CPU. In a standby state where there is no interrupt processing request, if it is normal, the timing control circuit of the asynchronous CPU does not operate and the value of the stack pointer 120 does not change. Abnormal operation due to inversion of the internal flip-flop value cannot be detected only by monitoring the value of the stack pointer. The above-described abnormality detection circuit 500 includes a circuit that detects changes in timing control signals of main registers (program pointer 110, stack pointer 120, and flag register 130) in the asynchronous CPU 100, and a zero that detects a state in which the CPU is not operating. Since the detection circuit 520 is provided, it is possible to detect that an abnormality has occurred in the internal state of the asynchronous CPU. Therefore, in the case of a microcontroller that operates in an event-driven manner, the standby state time may be significantly longer than the normal operation state, and it is possible to further increase the standby state reliability of a microcontroller equipped with an asynchronous CPU. Become.

  The abnormal state of the microcontroller includes CPU runaway, CPU deadlock, and CPU internal flip-flop (FF) abnormality during standby. Until now, it was possible to detect only when the CPU runaway was affected by the stack pointer, but according to the present invention, it is possible to detect an abnormal operation regardless of the influence on the stack pointer. That is, in the present invention, the number of interrupt requests accepted by the CPU and the number of interrupt processes completed by the CPU are measured by a counter. It is possible to detect whether the counter value indicating the number of accepted interrupt requests exceeds the preset upper limit value or indicates an underflow and detect a CPU runaway state or a deadlock state where the CPU does not operate. It becomes.

  Further, in the present invention, the number of interrupt requests whose execution is suspended is measured, and an abnormal state of the CPU is detected by detecting that the number reaches an upper limit value set in advance. As a result, even when multiple interrupts are prohibited or when an abnormality occurs during high priority interrupt processing, the CPU runaway state where no interrupt end signal is generated or the deadlock state where the CPU does not operate is abnormal. Can be detected.

  Furthermore, in the present invention, an abnormality is detected by two types of methods, that is, an abnormality detection based on the number of interrupt requests accepted by the CPU and an abnormality detection based on the number of interrupt requests whose execution is suspended. Therefore, the microcontroller equipped with the abnormality detection circuit of the present invention can flexibly set the threshold of abnormality detection according to the number of interrupt requests, the number and types of multiple interrupts of each system, and the frequency of occurrence, thereby improving system reliability. It becomes possible to raise.

  Also, as shown in the second embodiment, when interrupt processing is not being executed, an interrupt request is generated by monitoring the timing control signals of the CPU program counter, stack pointer, and flag register. It is also possible to detect an abnormal state in which the CPU operates even though it is not.

  Although the present invention has been described with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

100 CPU
110 Program Counter 120 Stack Pointer 130 Flag Register 200 Interrupt Controller 210, 220, 230 Interrupt Flag Register 251, 252 Peripheral Circuit 300 Abnormality Detection Circuit 310 Interrupt Flag Reservation Number Detection Circuit 320 Reservation Number Upper Limit Setting Register 330 Retention Number Abnormality Detection Circuit 360 Logic Sum circuit 400 Abnormality detection circuit 410 Interrupt counter 420 Interrupt acceptance number upper limit setting register 430 Counter abnormal value detection circuit 500 Abnormality detection circuit 510 OR circuit 520 Zero detection circuit 530 AND circuit

Claims (14)

CPU,
The count value is incremented based on the interrupt start signal indicating that the interrupt output in response to the interrupt signal indicating the interrupt request to the CPU is received, and indicates that the processing corresponding to the interrupt is completed. An interrupt counter for decrementing the count value based on an interrupt end signal;
A counter abnormal value detection circuit for detecting an abnormality by comparing the count value with a predetermined value ;
A flag register that is set in response to the interrupt signal and indicates that there is an interrupt request;
A pending number detection circuit for detecting an interrupt pending number indicated by the number of flag registers set among the flag registers;
An information processing apparatus, comprising: a pending number abnormality detection circuit that detects an abnormality by comparing the interrupt pending number with a predetermined number . A reception number register for holding an interrupt reception upper limit number indicating an upper limit of the multiple reception number of the interrupt;
The counter abnormal value detection circuit outputs a counter abnormality detection signal when the counter value indicates a value equal to or greater than the upper limit of acceptance held in the acceptance number register, or when the counter value indicates an underflow. The information processing apparatus according to claim 1. The information processing apparatus according to claim 1 , wherein the CPU stores the interrupt acceptance upper limit number in the acceptance number register. A holding number register for holding a holding upper limit number indicating an upper limit of the interrupt holding number;
The information processing apparatus according to claim 1 , wherein the hold number abnormality detection circuit outputs a hold number abnormality detection signal when the interrupt hold number indicates a value equal to or greater than the hold upper limit number. The information processing apparatus according to claim 1 , wherein the flag register is reset in response to the interrupt start signal. CPU,
The count value is incremented based on the interrupt start signal indicating that the interrupt output in response to the interrupt signal indicating the interrupt request to the CPU is received, and indicates that the processing corresponding to the interrupt is completed. An interrupt counter for decrementing the count value based on an interrupt end signal;
A counter abnormal value detection circuit for detecting an abnormality by comparing the count value with a predetermined value;
A timing control signal that monitors a timing control signal generated when the CPU is operating, detects that the timing control signal is generated when the CPU is stopped, and outputs a runaway detection signal and a monitoring circuit
To immediately Bei the
Information processing apparatus. The timing control signal monitoring circuit, when the count value of the interrupt counter indicates zero, to claim 6, wherein the CPU outputs a runaway detection signal upon detecting that the timing control signal as being stopped is generated The information processing apparatus described. The information processing apparatus according to claim 6 , wherein the timing control signal indicates a signal output when operating a register in the CPU. A semiconductor integrated circuit device on which the information processing device according to claim 1 is mounted. An abnormality detection method for detecting an operation abnormality of a CPU,
Incrementing a count value based on an interrupt start signal indicating acceptance of the interrupt output in response to an interrupt signal indicating a request for an interrupt to the CPU;
Decrementing the count value based on an interrupt end signal indicating that processing corresponding to the interrupt has ended;
Comparing the count value with a predetermined value to detect an abnormality in the counter value ;
Setting a flag register indicating that there is an interrupt request in response to the interrupt signal;
Detecting an interrupt pending number indicated by the number of flag registers set among the flag registers;
An abnormality detection method comprising: detecting an abnormality in the number of holds by comparing the number of held interrupts with a predetermined number . The step of detecting abnormality of the counter value includes:
Holding an interrupt acceptance upper limit number indicating an upper limit of the multiple acceptance number of the interrupt;
The abnormality detection method according to claim 10 , further comprising a step of determining that a counter abnormality is detected when the counter value indicates a value equal to or greater than the upper limit of acceptance or the counter value indicates an underflow. The step of detecting the abnormality of the number of holds is
Holding a pending upper limit number indicating an upper limit of the interrupt pending number in a pending number register;
The abnormality detection method according to claim 10 , further comprising a step of determining that the number of pending interrupts is abnormal when the interrupt pending number indicates a value greater than or equal to the upper limit number of suspensions. Monitoring a timing control signal generated when the CPU is operating;
Detecting a runaway when the timing control signal is generated when the CPU is stopped; and
Further abnormality detection method according to claim 10 having a. The step of detecting the runaway includes:
Determining whether the count value of the interrupt counter indicates zero;
The abnormality detection method according to claim 13 , further comprising a step of detecting a CPU runaway when the CPU is stopped when a count value of the interrupt counter indicates zero.

Images